This feature is in private preview and is not publicly available.
Reflector KEK Rotation
The Reflector encrypts its local storage with a Key Encrypting Key (KEK). When that KEK is held in a Kubernetes Secret, you can rotate it on a schedule or on demand, without restarting workloads and without re-encrypting stored payloads.
The Reflector's KEK is separate from any Trust Domain Server's. The two are never shared, each rotates on its own schedule, and each acts only on the annotation placed on its own Secret. For what a rotation does, the activation delay, and how KEK generations are retained, all of which are the same for both components, see KEK Rotation.
Rotation covers only the default Kubernetes Secret backend. A Reflector configured with reflector.aws, reflector.azure, or reflector.gcp uses a KEK held by that provider, and the provider owns its lifecycle.
The Reflector KEK Secret
By default the Reflector holds its KEK in a Secret named spirl-reflector-enc-keys, in the namespace where the spirl-system chart is installed.
One Reflector installation owns one KEK. To rotate several installations, act on each one's Secret separately.
Configuring a schedule
Set an interval in your spirl-system values:
reflector:
kekRotation:
interval: "720h"
The interval is a whole number of hours from 24h (one day) through 8760h (one year), written as a string. Whole hours are the only accepted spelling, so 1440m and 30d are rejected even where the equivalent hour value would be accepted. The chart fails to render on an interval it cannot accept:
reflector.kekRotation.interval must be a whole number of hours, e.g. "720h", got "1h30m"
reflector.kekRotation.interval must be between 24h (1 day) and 8760h (1 year), got "12h"
The schedule counts from the last rotation, not from pod start, so restarts and rescheduling do not reset it.
Omitting the kekRotation block disables the schedule. Manual rotation still works, and a rotation already under way still finishes.
The chart rejects a kekRotation block on a Reflector configured with a cloud KMS:
reflector.kekRotation requires the Kubernetes-Secret KEK backend; it cannot be combined with reflector.aws, reflector.azure, or reflector.gcp
Requesting rotation on demand
Trigger a rotation by overwriting an annotation on the Reflector's KEK Secret with an RFC 3339 timestamp. The Reflector already holds a Kubernetes watch on that Secret, so the change creates no Kubernetes object and needs no change to the Reflector's own permissions. You need permission to patch the Secret.
kubectl annotate secret -n <namespace> spirl-reflector-enc-keys \
'defakto.security/kek-rotation-requested-at='"$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--overwrite
A rotation needs no configured interval. It does need the Kubernetes Secret KEK backend. Each later rotation needs a strictly newer timestamp, so leave the annotation in place and overwrite it. An absent, repeated, equal, older, or invalid value does nothing. For the full set of rules on how a timestamp is interpreted, see Requesting rotation on demand.
Do not edit the data fields of the KEK Secret. The KEK material and the rotation state live there, and hand-editing them can make stored data impossible to decrypt. The annotation is the only supported way to drive a rotation from kubectl.
Monitoring
The Reflector exports metrics covering rotation under the spirl_reflector_ prefix. See KEK Rotation Metrics.